Privacy
What we hold, and why
This page is about two separate things that are easy to confuse: this website (how this site counts visits with our own analytics, what the chat assistant keeps, and how to reach us), and the FABLS service, which holds what it needs in order to run a plan on your behalf. Both are covered below, in that order.
This website
No cookies. Neither this site nor the services it uses set any. No scripts from other companies. Every page loads scripts only from this website and from two services run by Castomo: Observer (observer.castomo.com) and the chat button (chat.castomapi.com). The typefaces are served from this domain rather than from anybody else's, so opening a page here does not tell any other company that you did.
Analytics: Observer. We count visits with Observer, our own analytics, run by Castomo on its own server in Frankfurt. It sets no cookies and stores nothing on your device. For each page you open it records: the page address (of any query only campaign tags such as utm_source) and title, the site you came from, your browser, device type and operating system, your browser language, a rough screen-size bracket, how long the page was actively open, how fast it loaded, any script error, and — as totals — where people click and how far they scroll. It takes no recording of your screen and reads no keystrokes.
Your IP address is used for a moment, together with your browser, to make a code that changes every day and is different on every site. The IP address itself is never stored, and the server that delivers Observer keeps no access log. The code lets us count one visitor once a day, and it cannot be used to link a visit to visits on other days or other sites. Raw records are deleted after 24 hours; only totals are kept, for 25 months. If your browser sends Do Not Track or Global Privacy Control, Observer sends no visit data.
We do this because we have a legitimate interest in knowing how our pages are used (Article 6(1)(f) GDPR). You can object at any time: hello@castomo.com.
Chat assistant. Every page has a chat button run by Castomo (chat.castomapi.com, servers in Amsterdam). Until you open the chat, the button stores nothing on your device and starts no conversation; loading the page only fetches the button's settings from our chat server, which, like any web server, records the request, including your IP address, in a rotating log that is overwritten as it fills.
When you open the chat, the chat window saves a visitor code and a few settings in your browser's local storage, and our server creates a visitor record: the code (kept only as a hash), a hash of your IP address, your browser type, language and time zone, the page you were on and where you came from, and everything you type — plus your name, e-mail or phone number only if you give them.
The assistant is an AI, and it says so. Its answers are written by AI models run by OpenRouter (Google Gemini) and OpenAI, which receive what you type in order to reply; after a conversation ends the same text is sent to a model again to write a short summary. A person on our team can read the conversation and take it over. These providers may process data outside the European Economic Area.
We keep a visitor's record and conversations until 180 days after their last visit, then delete them. You can ask us to delete them sooner: hello@castomo.com. Please do not type anything you do not want us to have.
Your colour, text-size, spacing and motion preferences are stored in your own browser's local storage and never leave it. Clearing your site data removes them.
Only if you open the chat: castomo.chat.<widget id>.returning (the value 1) and, while the chat is open, castomo.chat.<widget id>.open, on this site; and castomo.chat.<widget id>.token and castomo.chat.<widget id>.visit on chat.castomapi.com. Nothing is written before you open it. Clearing your browser's site data removes them.
The demo on the home page is the one exception, and only if you use it. What you write about your business, the channels and posts a week you pick, and the month planned from them are sent to castomapi-try, our own service, run by Castomo P.S.A. on servers in the European Union, and kept as a draft for 30 days so you can come back to it. After 30 days an unsaved draft is deleted. The draft is opened by a key kept in your browser's local storage under a name beginning fbl: (not a cookie), and nobody else can open it unless you share a link to it; if you sign in to keep the month, that sign-in is kept there too. Your internet address is used only to stop the demo being abused — an hourly limit held in the service's memory and never written down.
A month planned from your description is written by an AI model: the description goes, through the OpenRouter routing service, to one of the model providers it lists, and some of those — free models in particular — may keep what they receive under their own terms. That is the demo; drafting inside FABLS is described further down. So describe the business, not anybody's personal data; the demo does not need any.
If you save the month to a castomo account, from then on it belongs to that account and is covered by the next section, The FABLS service: it stays until you delete it or the account.
The web server keeps ordinary access logs for a short period, as any web server does, for security and for diagnosing faults. There is no profile behind them and nothing is combined with anything else.
The FABLS service
Using FABLS means signing in with a castomo account, and from that point there is a service holding data in order to do the job. Specifically:
Your account. The e-mail address and account identity that castomo holds, plus which plan you are on and what has been billed. Standard, and unavoidable if anything is to be paid for.
Your writers and your plan. The personas you wrote or composed, the skills pinned to them, your themes, cadence, shares and seasonality, and every dated slot. These are documents on your account.
Drafts and published posts. What was written for each slot, what you edited, what you approved, when it published and what the platform said in reply. This is the record the reports are built from and the reason a failure can be explained rather than guessed at.
Channel connections. A key minted on your account, which is what publishing goes through. The permissions are yours; revoking the key stops publishing immediately.
Report recipients. The names, addresses and per-recipient settings you have entered — which, if you are an agency, are your clients' details rather than your own. They are used to deliver the reports you configured and for nothing else.
What a drafting step sends, and where
Drafting uses language models, and a draft is produced by sending a model the material it needs: the writer's persona and skills, the slot's theme and channel, the brand facts you supplied, and relevant recent posts so that it does not repeat itself.
What it does not send is everything else on your account. A draft for one business does not carry another business's material — which is the specific thing that matters if you are running several clients on one account.
Model providers are processors under contract, and the material is used to produce your draft rather than to train anybody's model. Where a model runs matters to some businesses; if it matters to yours, ask before you start rather than after.
Who else sees anything
The platforms you connected. Publishing means sending your post to Facebook, Instagram or your WordPress site, and those platforms then hold it under their own terms. That is the point of publishing, and it is worth saying plainly.
castomAPI. The platform underneath, run by the same company, carries the posting and can supply royalty-free images with their licences attached.
Your report recipients. Exactly the people you listed, receiving exactly the sections you chose.
Nothing is sold, and nothing is passed to an advertising network. There is no advertising network involved in any part of this.
How long, and how to get it back or removed
Your writers, plans, drafts and publishing history are kept while your account exists, because a report about November cannot be produced from a database that has forgotten November. Access logs are short-lived. Billing records are kept for as long as tax law requires, which is not a decision we get to make.
You can ask for a copy of what we hold — including a chat conversation, if you started one — a correction of something wrong, or a deletion. Write to hello@castomo.com and say which; it reaches a person. Deleting your account removes your writers, plans and drafts across the family — one account means one deletion rather than seven.
Posts already published to Facebook, Instagram or your own site are not ours to remove. They are on your channels, under your control, and deleting them is done there.
The controller
The controller is Castomo prosta spółka akcyjna, ul. Powstańców Śląskich 5/212, 53-332 Wrocław, Poland. The full registration details are in the footer of every page on this site.
Where you are running FABLS on behalf of your own clients — an agency, most obviously — you are the controller of your clients' material and we are processing it for you. If you need that written down as a data processing agreement, ask and you will get one.
You have the rights the GDPR gives you, including the right to complain to a supervisory authority. In Poland that is the President of the Personal Data Protection Office. We would rather you wrote to us first, but that is your choice and not a precondition.
Plainly: this site counts visits with our own analytics; it keeps a draft, for 30 days unless you keep it, only if you try the demo; and it keeps a visitor record and your conversation, until 180 days after your last visit, only if you open the chat. The service holds what it must in order to write, publish and report on your behalf, and it is all visible to you inside the app. If something here is unclear, that is worth an e-mail — the answer usually improves this page.